Re: [PATCH v4 05/11] gdb, gdbserver: Add support of Intel shadow stack pointer register.

[Luis Machado <luis.machado@arm.com>]

On 6/17/25 13:11, Christina Schimpe wrote:
> This patch adds the user mode register PL3_SSP which is part of the
> Intel(R) Control-Flow Enforcement Technology (CET) feature for support
> of shadow stack.
> For now, only native and remote debugging support for shadow stack
> userspace on amd64 linux are covered by this patch including 64 bit and
> x32 support.  32 bit support is not covered due to missing Linux kernel
> support.
> 
> This patch requires fixing the test gdb.base/inline-frame-cycle-unwind
> which is failing in case the shadow stack pointer is unavailable.
> Such a state is possible if shadow stack is disabled for the current thread
> but supported by HW.
> 
> This test uses the Python unwinder inline-frame-cycle-unwind.py which fakes
> the cyclic stack cycle by reading the pending frame's registers and adding
> them to the unwinder:
> 
> ~~~
> for reg in pending_frame.architecture().registers("general"):
>      val = pending_frame.read_register(reg)
>      unwinder.add_saved_register(reg, val)
>      return unwinder
> ~~~
> 
> However, in case the python unwinder is used we add a register (pl3_ssp) that is
> unavailable.  This leads to a NOT_AVAILABLE_ERROR caught in
> gdb/frame-unwind.c:frame_unwind_try_unwinder and it is continued with standard
> unwinders.  This destroys the faked cyclic behavior and the stack is
> further unwinded after frame 5.
> 
> In the working scenario an error should be triggered:
> ~~~
> bt
> 0  inline_func () at /tmp/gdb.base/inline-frame-cycle-unwind.c:49^M
> 1  normal_func () at /tmp/gdb.base/inline-frame-cycle-unwind.c:32^M
> 2  0x000055555555516e in inline_func () at /tmp/gdb.base/inline-frame-cycle-unwind.c:45^M
> 3  normal_func () at /tmp/gdb.base/inline-frame-cycle-unwind.c:32^M
> 4  0x000055555555516e in inline_func () at /tmp/gdb.base/inline-frame-cycle-unwind.c:45^M
> 5  normal_func () at /tmp/gdb.base/inline-frame-cycle-unwind.c:32^M
> Backtrace stopped: previous frame identical to this frame (corrupt stack?)
> (gdb) PASS: gdb.base/inline-frame-cycle-unwind.exp: cycle at level 5: backtrace when the unwind is broken at frame 5
> ~~~
> 
> To fix the Python unwinder, we simply skip the unavailable registers.
> 
> Reviewed-by: Thiago Jung Bauermann <thiago.bauermann@linaro.org>
> Reviewed-By: Eli Zaretskii <eliz@gnu.org>
> ---
>  gdb/NEWS                                      |  3 +
>  gdb/amd64-linux-nat.c                         | 17 +++++
>  gdb/amd64-linux-tdep.c                        |  1 +
>  gdb/amd64-tdep.c                              |  6 +-
>  gdb/amd64-tdep.h                              |  1 +
>  gdb/arch/amd64.c                              | 10 +++
>  gdb/arch/i386.c                               |  4 ++
>  gdb/arch/x86-linux-tdesc-features.c           |  1 +
>  gdb/doc/gdb.texinfo                           |  4 ++
>  gdb/features/Makefile                         |  2 +
>  gdb/features/i386/32bit-ssp.c                 | 14 ++++
>  gdb/features/i386/32bit-ssp.xml               | 11 +++
>  gdb/features/i386/64bit-ssp.c                 | 14 ++++
>  gdb/features/i386/64bit-ssp.xml               | 11 +++
>  gdb/i386-tdep.c                               | 22 +++++-
>  gdb/i386-tdep.h                               |  4 ++
>  gdb/nat/x86-linux-tdesc.c                     |  2 +
>  gdb/nat/x86-linux.c                           | 55 +++++++++++++++
>  gdb/nat/x86-linux.h                           |  4 ++
>  gdb/testsuite/gdb.arch/amd64-shadow-stack.c   | 22 ++++++
>  gdb/testsuite/gdb.arch/amd64-ssp.exp          | 50 +++++++++++++
>  .../gdb.base/inline-frame-cycle-unwind.py     |  4 ++
>  gdb/testsuite/lib/gdb.exp                     | 70 +++++++++++++++++++
>  gdb/x86-linux-nat.c                           | 50 +++++++++++--
>  gdb/x86-linux-nat.h                           | 11 +++
>  gdb/x86-tdep.c                                | 21 ++++++
>  gdb/x86-tdep.h                                |  9 +++
>  gdbserver/linux-x86-low.cc                    | 28 +++++++-
>  gdbsupport/x86-xstate.h                       |  5 +-
>  29 files changed, 446 insertions(+), 10 deletions(-)
>  create mode 100644 gdb/features/i386/32bit-ssp.c
>  create mode 100644 gdb/features/i386/32bit-ssp.xml
>  create mode 100644 gdb/features/i386/64bit-ssp.c
>  create mode 100644 gdb/features/i386/64bit-ssp.xml
>  create mode 100644 gdb/testsuite/gdb.arch/amd64-shadow-stack.c
>  create mode 100644 gdb/testsuite/gdb.arch/amd64-ssp.exp
> 

<...>

> diff --git a/gdb/nat/x86-linux.c b/gdb/nat/x86-linux.c
> index 0bdff736f8a..bf603182164 100644
> --- a/gdb/nat/x86-linux.c
> +++ b/gdb/nat/x86-linux.c
> @@ -17,6 +17,12 @@
>     You should have received a copy of the GNU General Public License
>     along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
>  
> +#include "elf/common.h"
> +#include "gdbsupport/common-defs.h"
> +#include "nat/gdb_ptrace.h"
> +#include "nat/linux-ptrace.h"
> +#include "nat/x86-cpuid.h"
> +#include <sys/uio.h>
>  #include "x86-linux.h"
>  #include "x86-linux-dregs.h"
>  #include "nat/gdb_ptrace.h"
> @@ -126,3 +132,52 @@ x86_linux_ptrace_get_arch_size (int tid)
>    return x86_linux_arch_size (false, false);
>  #endif
>  }
> +
> +bool
> +x86_check_ssp_support (const int tid)

Missing the usual comment pointing at the header file?

/* See nat/x86-linux.h.  */

> +{
> +  /* It's not enough to check shadow stack support with the ptrace call
> +     below only, as we cannot distinguish between shadow stack not enabled
> +     for the current thread and shadow stack is not supported by HW.  In
> +     both scenarios the ptrace call fails with ENODEV.  In case shadow
> +     stack is not enabled for the current thread, we still want to return
> +     true.  */
> +  unsigned int eax, ebx, ecx, edx;
> +
> +  __get_cpuid_count (7, 0, &eax, &ebx, &ecx, &edx);
> +
> +  if ((ecx & bit_SHSTK) == 0)
> +    return false;
> +
> +  /* Further check for NT_X86_SHSTK kernel support.  */
> +  uint64_t ssp;
> +  iovec iov {&ssp, sizeof (ssp) };
> +
> +  errno = 0;
> +  int res = ptrace (PTRACE_GETREGSET, tid, NT_X86_SHSTK, &iov);
> +  if (res < 0)
> +    {
> +      if (errno == EINVAL)
> +	{
> +	  /* The errno EINVAL for a PTRACE_GETREGSET call indicates that
> +	     kernel support is not available.  */
> +	  return false;
> +	}
> +      else if (errno == ENODEV)
> +	{
> +	  /* At this point, since we already checked CPUID, the errno
> +	     ENODEV for a PTRACE_GETREGSET call indicates that shadow
> +	     stack is not enabled for the current thread.  As it could be
> +	     enabled later, we still want to return true here.  */
> +	  return true;
> +	}
> +      else
> +	{
> +	  warning (_("Unknown ptrace error for NT_X86_SHSTK: %s"),
> +		   safe_strerror (errno));
> +	  return false;
> +	}
> +    }
> +
> +  return true;
> +}

<...>

> diff --git a/gdb/testsuite/lib/gdb.exp b/gdb/testsuite/lib/gdb.exp
> index 3f1cd55d727..7e56cf61a4c 100644
> --- a/gdb/testsuite/lib/gdb.exp
> +++ b/gdb/testsuite/lib/gdb.exp
> @@ -4287,6 +4287,76 @@ gdb_caching_proc allow_tsx_tests {} {
>      return $allow_tsx_tests
>  }
>  
> +# Run a test on the target to check if it supports x86 shadow stack.  Return 1
> +# if shadow stack is enabled, 0 otherwise.
> +
> +gdb_caching_proc allow_ssp_tests {} {
> +    global srcdir subdir gdb_prompt hex
> +
> +    set me "allow_ssp_tests"
> +
> +    if { ![istarget i?86-*-*] && ![istarget x86_64-*-* ] } {
> +	verbose "$me: target known to not support shadow stack."
> +	return 0
> +    }
> +
> +    # There is no need to check the actual HW in addition to ptrace support.
> +    # We need both checks and ptrace will tell us about the HW state.
> +    set compile_flags "{additional_flags=-fcf-protection=return}"
> +    set src { int main() { return 0; } }
> +    if {![gdb_simple_compile $me $src executable $compile_flags]} {
> +	return 0
> +    }
> +
> +    save_vars { ::env(GLIBC_TUNABLES) } {
> +
> +	append_environment GLIBC_TUNABLES "glibc.cpu.hwcaps" "SHSTK"
> +
> +	# No error message, compilation succeeded so now run it via gdb.
> +	gdb_exit
> +	gdb_start
> +	gdb_reinitialize_dir $srcdir/$subdir
> +	gdb_load $obj
> +	if {![runto_main]} {
> +	    remote_file build delete $obj
> +	    return 0
> +	}
> +	set shadow_stack_disabled_re "(<unavailable>)"
> +	if {[istarget *-*-linux*]} {
> +	    # Starting with v6.6., the Linux kernel supports CET shadow stack.

Small typo, period after v6.6.

> +	    # Dependent on the target we can see a nullptr or "<unavailable>"
> +	    # when shadow stack is supported by HW and the Linux kernel but
> +	    # not enabled for the current thread (for example due to a lack
> +	    # of compiler or glibc support for -fcf-protection).
> +	    set shadow_stack_disabled_re "$shadow_stack_disabled_re|(.*0x0)"
> +	}
> +
> +	set allow_ssp_tests 0
> +	gdb_test_multiple "print \$pl3_ssp" "test shadow stack support" {
> +	    -re -wrap "(.*$hex)((?!(.*0x0)).)" {
> +		verbose -log "$me: Shadow stack support detected."
> +		set allow_ssp_tests 1
> +	    }
> +	    -re -wrap $shadow_stack_disabled_re {
> +		# In case shadow stack is not enabled (for example due to a
> +		# lack of compiler or glibc support for -fcf-protection).
> +		verbose -log "$me: Shadow stack is not enabled."
> +	    }
> +	    -re -wrap "void" {
> +		# In case we don't have hardware or kernel support.
> +		verbose -log "$me: No shadow stack support."
> +	    }
> +	}
> +
> +	gdb_exit
> +    }
> +
> +    remote_file build delete $obj
> +
> +    verbose "$me: returning $allow_ssp_tests" 2
> +    return $allow_ssp_tests
> +}
> +
>  # Run a test on the target to see if it supports avx512bf16.  Return 1 if so,
>  # 0 if it does not.  Based on 'check_vmx_hw_available' from the GCC testsuite.
>  
> diff --git a/gdb/x86-linux-nat.c b/gdb/x86-linux-nat.c
> index a82ad21da27..865c017404e 100644
> --- a/gdb/x86-linux-nat.c
> +++ b/gdb/x86-linux-nat.c
> @@ -41,6 +41,7 @@
>  #include "nat/x86-linux.h"
>  #include "nat/x86-linux-dregs.h"
>  #include "nat/linux-ptrace.h"
> +#include "x86-tdep.h"
>  #include "nat/x86-linux-tdesc.h"
>  
>  /* linux_nat_target::low_new_fork implementation.  */
> @@ -97,11 +98,10 @@ const struct target_desc *
>  x86_linux_nat_target::read_description ()
>  {
>    /* The x86_linux_tdesc_for_tid call only reads xcr0 the first time it is
> -     called.  The mask is stored in XSTATE_BV_STORAGE and reused on
> -     subsequent calls.  Note that GDB currently supports features for user
> -     state components only.  However, once supervisor state components are
> -     supported in GDB XSTATE_BV_STORAGE will not be configured based on
> -     xcr0 only.  */
> +     called.  Also it checks the enablement state of features which are
> +     not configured in xcr0, such as CET shadow stack.  Once the supported
> +     features are identified, the XSTATE_BV_STORAGE value is configured
> +     accordingly and preserved for subsequent calls of this function.  */
>    static uint64_t xstate_bv_storage;
>  
>    if (inferior_ptid == null_ptid)
> @@ -215,6 +215,46 @@ x86_linux_get_thread_area (pid_t pid, void *addr, unsigned int *base_addr)
>  }
>  \f
>  
> +/* See x86-linux-nat.h.  */
> +
> +void
> +x86_linux_fetch_ssp (regcache *regcache, const int tid)
> +{
> +  uint64_t ssp = 0x0;
> +  iovec iov {&ssp, sizeof (ssp)};
> +
> +  /* The shadow stack may be enabled and disabled at runtime.  Reading the
> +     ssp might fail as shadow stack was not activated for the current
> +     thread.  We don't want to show a warning but silently return.  The
> +     register will be shown as unavailable for the user.  */
> +  if (ptrace (PTRACE_GETREGSET, tid, NT_X86_SHSTK, &iov) != 0)
> +    return;
> +
> +  x86_supply_ssp (regcache, ssp);
> +}
> +
> +/* See x86-linux-nat.h.  */
> +
> +void
> +x86_linux_store_ssp (const regcache *regcache, const int tid)
> +{
> +  uint64_t ssp = 0x0;
> +  iovec iov {&ssp, sizeof (ssp)};
> +  x86_collect_ssp (regcache, ssp);
> +
> +  /* Starting with v6.6., the Linux kernel supports CET shadow stack.

Same typo, period after v6.6

> +     Dependent on the target the ssp register can be unavailable or
> +     nullptr when shadow stack is supported by HW and the Linux kernel but
> +     not enabled for the current thread.  In case of nullptr, GDB tries to
> +     restore the shadow stack pointer after an inferior call.  The ptrace
> +     call with PTRACE_SETREGSET will fail here with errno ENODEV.  We
> +     don't want to throw an error in this case but silently continue.  */
> +  errno = 0;
> +  if ((ptrace (PTRACE_SETREGSET, tid, NT_X86_SHSTK, &iov) != 0)
> +      && (errno != ENODEV))
> +    perror_with_name (_("Failed to write pl3_ssp register"));
> +}
> +
>  void _initialize_x86_linux_nat ();
>  void
>  _initialize_x86_linux_nat ()

<...>

Other than the cosmetic points above, the patch looks OK to me. I'm not entirely familiar
with the feature for x86, but the enablement makes sense to me.

Reviewed-By: Luis Machado <luis.machado@arm.com>